osixia / docker-phpLDAPadmin

phpLDAPadmin container image 🐳🌴
MIT License
844 stars 197 forks source link

Connect to openldap using TLS doesn't work #33

Closed kopax closed 7 years ago

kopax commented 7 years ago

I have configured osixia/docker-openldap server to only accept TLS connection with.

I have successfully run a ldapwhoami command with -ZZ (force TLS) and it work.

I don't know why but playing with these doesn't change anything for me :

PHPLDAPADMIN_LDAP_CLIENT_TLS: true
PHPLDAPADMIN_LDAP_CLIENT_TLS_REQCERT: demand
PHPLDAPADMIN_LDAP_CLIENT_TLS_CA_CRT_FILENAME: ca.crt

Also I wonder what are these for. I have played with and it didn't change.

Why does the TLS client needs to have this? Why some some other don't ? (sonarqube ldap plugin, gitlab) ? Are they required or mandatory ?

PHPLDAPADMIN_LDAP_CLIENT_TLS_CRT_FILENAME
PHPLDAPADMIN_LDAP_CLIENT_TLS_KEY_FILENAME

The form login return the following errors:

error
Unable to connect to LDAP server ldap.domain.com
Error: Confidentiality required (13) for user
error   Failed to Authenticate to server
Invalid Username or Password..

phpldapadmin log:

59565d5b conn=1014 op=0 RESULT tag=97 err=13 text=TLS confidentiality required 

Finally, this is the end of my file /var/www/phpldapadmin/config/config.php

/*********************************************
 * Define your LDAP servers in this section  *
 *********************************************/

$servers = new Datastore();

/*
 * Autogenerated servers variables will come here
 */
$servers->newServer('ldap_pla');
$servers->setValue('server','name','ldap.domain.com');
$servers->setValue('server','host','ldap.domain.com');

I don't feel like the TLS configuration is working, what am I doing wrong ?

kopax commented 7 years ago

I was missing this:

PHPLDAPADMIN_LDAP_HOSTS: #PYTHON2BASH:[{'ldap.domain.com': [{'server': [{'tls': True}]}]}]